fix: enforce the OAuth deadline across the proxy hop (#2319 round 5)

Two findings, both real.

The race bounded only the caller's promise on the browser path.
`createRemoteFetch` dropped the signal, so an abort — including the
deadline's own — left the POST to /api/fetch in flight; the backend
never saw its request cancelled and its outbound fetch ran on with
neither signal nor timeout, holding a handler and an authorization-server
socket per timed-out attempt. `createRemoteFetch` now forwards the
caller's signal (init.signal when present and not undefined, else a
Request's own), and the /api/fetch route composes `c.req.raw.signal`
with a server-side deadline matching the client budget, cleared in
`finally` so a streaming response is not severed.

A probe's own timeout was swallowed by `withRfc8414OidcCompat`, which
returned the preceding 404 and discarded the endpoint name the deadline
exists to provide. A deadline the Inspector imposed is its own error,
not the server's answer, so it escapes now; every other probe failure
still falls back as documented. Nothing regresses: every candidate the
loop probes is one the SDK's own buildDiscoveryUrls emits, so a stall
there is one the SDK would have hit itself, unbounded.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YFnM6RqB4nXqNysgUYmjmq
Signed-off-by: cliffhall <cliff@futurescale.com>

core/mcp/remote/createRemoteFetch.ts

@@ -133,10 +133,27 @@ export function createRemoteFetch(options: RemoteFetchOptions): typeof fetch {
       reqHeaders["x-mcp-remote-auth"] = `Bearer ${options.authToken}`;
     }
 
+    // #2319: forward the caller's cancellation onto the proxy hop. Without it
+    // an abort — including the OAuth deadline's own — settled only the caller's
+    // promise: the POST stayed in flight, so the backend never saw its request
+    // cancelled and its outbound fetch to the authorization server was left
+    // running detached, holding a handler and a socket for as long as the
+    // server cared to stall (Copilot). `init.signal` wins when present and not
+    // `undefined` (a WebIDL dictionary member present as `undefined` converts
+    // as absent), otherwise a `Request` carries its own.
+    const explicitSignal = init?.signal;
+    const signal =
+      explicitSignal !== undefined
+        ? (explicitSignal ?? undefined)
+        : input instanceof Request
+          ? input.signal
+          : undefined;
+
     const res = await fetchFn(`${baseUrl}/api/fetch`, {
       method: "POST",
       headers: reqHeaders,
       body: JSON.stringify({ url, method, headers, body }),
+      signal,
     });
 
     if (!res.ok) {